Description
aStats 1.6.5 allows local users to overwrite arbitrary files via a symlink attack on (1) the aStats-Graphic-Signature-Generation file and (2) certain PNG image files.
References
- [Debian-audit] 20041229 More temporary filenames/dirs related bugs mailing-list
- 13679 third-party-advisory
- 12128 vdb-entry
- astats-symlink(18698) vdb-entry
- 12632 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=287604